Gentoo Archives: gentoo-project

From: desultory <desultory@g.o>
To: gentoo-project@l.g.o, "Andreas K. Huettel" <dilfridge@g.o>
Cc: Matthew Thode <prometheanfire@g.o>
Subject: Re: [gentoo-project] pre-GLEP: Gentoo OpenPGP web of trust
Date: Sat, 02 Feb 2019 06:02:42
Message-Id: e8b9acd8-f082-54aa-b6a4-f48521deb625@gentoo.org
In Reply to: Re: [gentoo-project] pre-GLEP: Gentoo OpenPGP web of trust by "Andreas K. Huettel"
1 On 02/01/19 07:47, Andreas K. Huettel wrote:
2 >>
3 >> I don't see anything in glep 76 about requiring verification of the
4 >> signatures. It's my view (as trustee) that assertation by the signer
5 >> that 'this is my signature' is sufficient.
6 >
7 > ^ This.
8 >
9 > It's not our business to check IDs, and it's not our business to stalk people
10 > on google or facebook.
11 >
12 True, even according to GLEP 76.
13
14 > Now if someone says "Here's my name, and actually it is a fake name", then
15 > that is a reason to refuse commit rights or patch acceptance, and probably ask
16 > for some sort of verification when another name is then given.
17 >
18 False, though that falsehood drove acceptance of GLEP 76.
19
20 > (That behaviour is roughly as intelligent as walking up to the security guy at
21 > the airport and claiming loudly "I have a bomb in my luggage.")
22 > As with your previous assertion, this is false, it is also pointlessly
23 hyperbolic.
24
25 > Apart from that, I dont think we should care.
26 >